mbox series

[isar-cip-core,v2,0/3] Separate swu signing script from key

Message ID 20240912100710.3183806-1-Quirin.Gylstorff@siemens.com (mailing list archive)
Headers show
Series Separate swu signing script from key | expand

Message

Quirin Gylstorff Sept. 12, 2024, 10:06 a.m. UTC 
From: Quirin Gylstorff <quirin.gylstorff@siemens.com>

Some downstream projects use Hardware security module(HSM) to sign their
updates. To avoid a error message in case a HSM is used the user needs
override the major parts of the swupdate-certificates-key recipe. To
reduce the integration work in a downstream layer:
- seperate the signing script from the keys
- move the package installation of th scripts out of the swupdate.bbclass.
- update the readme to show this new behaviour

Changes in v2:
 - remove SWU_SIGN_SCRIPT variable
 - remove rsa-swu-sign script
 - fix typos in commit messages
 - rename swu-signer to swu-signer-snakeoil

Quirin Gylstorff (3):
  Move signing script to seperate package to better support HSM signing
  Add check for sign-swu executable
  Update README for swupdate signing

 classes/swupdate.bbclass                      |  7 +++--
 doc/README.swupdate.md                        | 13 +++++++---
 recipes-core/images/swupdate.inc              |  5 +++-
 .../swupdate-certificates/files/sign-swu-rsa  |  6 -----
 .../swupdate-certificates-key.inc             |  9 +------
 .../files/sign-swu-cms                        |  0
 .../swupdate-signer-snakeoil_0.1.bb           | 26 +++++++++++++++++++
 7 files changed, 46 insertions(+), 20 deletions(-)
 delete mode 100644 recipes-devtools/swupdate-certificates/files/sign-swu-rsa
 rename recipes-devtools/{swupdate-certificates => swupdate-signer}/files/sign-swu-cms (100%)
 create mode 100644 recipes-devtools/swupdate-signer/swupdate-signer-snakeoil_0.1.bb